Isaca Updated CISM Exam Questions and Answers by dennis

A security information and event management (SIEM) system is a type of detective control because it monitors and analyzes the security events or logs from different sources or systems, and detects any anomalies or incidents that may indicate a security breach or compromise. A preventive control is a type of control that prevents or blocks any unauthorized or malicious activity or access from occurring. A deterrent control is a type of control that discourages or warns any potential attackers or intruders from attempting any unauthorized or malicious activity or access. A corrective control is a type of control that restores or repairs any damage or disruption caused by an unauthorized or malicious activity or access. References: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/the-value-of-penetration-testing https://www.isaca.org/resources/isaca-journal/issues/2016/volume-5/security-scanning-versus-penetration-testing

The correct answer is C because information security risk management is most effectively aligned with business objectives when it is integrated into the organization’s broader governance and enterprise risk management framework. This ensures security risks are evaluated alongside strategic, operational, financial, legal, and compliance risks. It also enables consistent risk appetite, reporting, ownership, escalation, and decision-making across the enterprise. Mandating ERM policy enforcement may support consistency, but enforcement alone does not ensure that information security risk is properly governed and integrated. Implementing multiple layers of technical controls may reduce some risks, but technical controls alone may not align with business priorities or risk appetite. Annual training is useful for awareness, but it is not sufficient to align risk management with business objectives. CISM emphasizes governance, business alignment, risk ownership, and integration with enterprise risk processes. Therefore, establishing an information security governance framework integrated with ERM is the best answer.

= Information classification is the process of assigning appropriate labels to information assets based on their sensitivity and value to the organization. Information classification should be aligned with the business objectives and risk appetite of the organization, and should be reviewed periodically to ensure its accuracy and relevance. The information security manager is responsible for establishing and maintaining the information classification policy and procedures, as well as providing guidance and oversight to the data owners and custodians. Data owners are the individuals who have the authority and accountability for the information assets within their business unit or function. Data owners are responsible for determining the appropriate classification level and security controls for their information assets, as well as ensuring compliance with the information classification policy and procedures. Data custodians are the individuals who have the operational responsibility for implementing and maintaining the security controls for the information assets assigned to them by the data owners.

If the information security manager believes that information has been classified inappropriately, increasing the risk of a breach, the best action is to complete a risk assessment and refer the results to the data owners. A risk assessment is a systematic process of identifying, analyzing, and evaluating the risks associated with the information assets, and recommending appropriate risk treatment options. By conducting a risk assessment, the information security manager can provide objective and evidence-based information to the data owners, highlighting the potential impact and likelihood of a breach, as well as the cost and benefit of implementing additional security controls. This will enable the data owners to make informed decisions about the appropriate classification level and security controls for their information assets, and to justify and document any deviations from the information classification policy and procedures.

The other options are not the best actions for the information security manager. Refering the issue to internal audit for a recommendation is not the best action, because internal audit is an independent and objective assurance function that provides assurance on the effectiveness of governance, risk management, and control processes. Internal audit is not responsible for providing recommendations on information classification, which is a management responsibility. Re-classifying the data and increasing the security level to meet business risk is not the best action, because the information security manager does not have the authority or accountability for the information assets, and may not have the full understanding of the business context and objectives of the data owners. Instructing the relevant system owners to reclassify the data is not the best action, because system owners are not the same as data owners, and may not have the authority or accountability for the information assets either. System owners are the individuals who have the authority and accountability for the information systems that process, store, or transmit the information assets. System owners are responsible for ensuring that the information systems comply with the security requirements and controls defined by the data owners and the information security manager. References = CISM Review Manual, 16th Edition, ISACA, 2020, pp. 49-51, 63-64, 69-701; CISM Online Review Course, Domain 3: Information Security Program Development and Management, Module 2: Information Security Program Framework, ISACA2

The correct answer is D because security culture is strongly influenced by leadership behavior. Senior management must set the tone from the top by consistently demonstrating good security practices, following policies, supporting security initiatives, and making risk-aware decisions. Employees are more likely to adopt secure behavior when they see executives and managers treating security as a business priority. Approving security policies is important, but approval alone does not create culture unless leaders also model expected behavior. Reviewing budget and resources supports the program, but it does not directly shape everyday security behavior. Participating in security training is positive and visible, but demonstrating good security practices on an ongoing basis has a broader cultural impact. In CISM governance, management commitment, accountability, communication, and example-setting are essential for embedding information security into the organization’s values and operations. Therefore, leadership behavior is the most important factor in improving information security culture.